PHP SECURITY UPDATE
PHP2Shell fix and PHP upgrade service
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote code execution on almost every PHP website. Only an update to a patched PHP release is a complete fix. SA Web Studio checks your version, applies the update or upgrade and makes sure your site still works afterwards.
What the PHP security team published on 21 October 2026
- Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every earlier version back to PHP 5.4 is vulnerable.
- Affected: all installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php carries the highest risk.
- PHP 8.1 and older receive no official release. Sites on PHP 7.4, 8.0 or 8.1 need an upgrade to a supported branch unless the hosting vendor backports a fix.
- Workarounds such as session.upload_progress.enabled=0 reduce exposure but do not make an installation safe.
Information checked on 22 October 2026 against the official advisory.Read the php.net security advisory
What we check and fix
- PHP version audit across every website, server and hosting account you use
- Update to the patched release, or an upgrade from end-of-life PHP 7.4, 8.0 or 8.1 to PHP 8.2 or newer
- Compatibility check and fixes for WordPress plugins and themes, Laravel and Composer packages, or custom PHP code
- Interim hardening where the update has to wait: session upload progress off, memory and request-size limits, firewall rules
- Worker restarts, version verification and a smoke test of key pages and forms after the change
- A short written summary of what was changed and what to watch next
How it works
Share your set-up
Tell us which platform you run, where it is hosted and, if you know it, the current PHP version. Hosting access can be arranged securely.
Review and plan
We confirm the version, check what the update or upgrade would affect and agree a maintenance moment with you.
Update and verify
We apply the patched release or upgrade, restart the workers, test the site and send you a summary.
A FEW THINGS, ANSWERED
Good questions.
Clear answers.
From the first brief to the next steps. Here’s what you might like to know.
Send a short note and we will come back to you with clear next steps.
01Is my website affected by PHP2Shell?
If your website runs on PHP and the version is older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12, it is affected. This covers WordPress, Laravel, Symfony, Magento, Drupal and custom PHP sites on PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. Share your hosting details and we can confirm the version for you.
02Which PHP version fixes CVE-2026-109618 and CVE-2026-109619?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026. Any earlier release in those branches is vulnerable. PHP 8.1 and older no longer receive updates from the PHP project, so they need an upgrade to a supported branch rather than a patch.
03My hosting still runs PHP 7.4 or 8.1. What now?
Those branches are end of life and will not get an official fix. Some Linux distributions and hosting providers ship their own backported fix; we check whether yours did. If not, the practical route is a planned upgrade to PHP 8.2 or newer, with a compatibility check of your plugins, packages and custom code first.
04Can you update PHP without breaking my WordPress or Laravel site?
The update itself is small, but an upgrade across major versions can expose outdated plugins, themes or packages. We review the site before the change, apply it in a staging or maintenance window where available, test the key pages and forms afterwards and fix what the new version flags.
05Is a firewall rule or the php.ini workaround enough?
No. PHP states that only an update is a complete fix. Setting session.upload_progress.enabled to 0, an unrestricted memory_limit and a web application firewall reduce exposure to known attack paths, and we can apply them as a stopgap, but the patched PHP release should follow as soon as possible.
LET’S MAKE YOUR NEXT MOVE
Ready to move your
business forward?
Tell us where you want to go. We can help you shape the website, application or integration to get started.
Let’s talk about your project